News for hackers. Stuff that matters.
Re:What HashiCorp’s License Change Means for Spacelift Custo... by afiori on Friday August 11, 2023 @04:55PM (#37093894)
I believe that the AGPL has the same boundaries as the GPL that is if you for example run a nodejs server using a single AGPL package in your node_modules then users should be able to download the source code of your entire node app.
Re:What HashiCorp’s License Change Means for Spacelift Custo... by josephcsible on Friday August 11, 2023 @05:19PM (#37094178)
But now you're talking about using an AGPL library in your own program, rather than deploying just an AGPL-licensed program.
Re:What HashiCorp’s License Change Means for Spacelift Custo... by afiori on Saturday August 12, 2023 @02:54AM (#37097716)
libraries are software
Re:What HashiCorp’s License Change Means for Spacelift Custo... by josephcsible on Saturday August 12, 2023 @01:32PM (#37102398)
Yes, but my point is there's a difference between "just deploy their software" and "combine their software with your software and deploy the result".
Re:What HashiCorp’s License Change Means for Spacelift Custo... by afiori on Monday August 14, 2023 @02:59AM (#37118257)
I agree, but for example it is not obvious whether you can deploy mixed licenses with docker-compose.
Re:What HashiCorp’s License Change Means for Spacelift Custo... by andrewl-hn on Monday August 14, 2023 @08:15AM (#37120156)
When you include an AGPL library your program becomes a derivative work, so the rest of your program becomes AGPL-licensed as well. The boundaries of what part of the system should or should not be included are vague, because *GPL licenses are written with C semantics in mind. So, while having a library directly in the same running process definitely makes you work a derivative, it's not clear if you the same is true if the library is a part of a different process and your program talks to it via an IPC, a filesystem, a database, an API, etc. Depending of the interpretation you may have toped-source just a tiny part of your program running on a server, or all server-side and client-side code and all supplemental scripts, tools, etc. needed for the system to run.

So, it's legally ambiguous, and since no-one has legally tested the waters the interpretation of the license can be very different, but most people prefer to stay away from AGPL code altogether.